How can I ascertain and test SQL injection vunerabilities on this login code?

Question

I know about the "little bobby tables" scenario and was just wondering if this code is vulnerable to such SQL injections.

^{I am fairly new to PHP and am curious about this.}

My code for a login script:

<?php
  # session
  session_start();

  # get the variables from login.php
  $userid = $_POST["userid"];
  $pword = $_POST["pword"];

  mysql_real_escape_string($userid);
  mysql_real_escape_string($pword);

  # query the DB 
  $query = mysql_query ("
    SELECT username 
    FROM login 
    WHERE username = '$userid' 
    AND pword = '$pword';
  ");

  if ($query === FALSE) {
    die('There has been an error.<br><br> Please re-enter your Login Details on the <b><a href="login.php">Login</a></b> Page.<br><br>');
  }

  $result = mysql_fetch_assoc($query);
  $record = $result['username'] ;

  # valid login
  # check if session is operational, if so redirect the user
  # to the correct page
  if ($record != null) {
    $_SESSION['login'] = true;
    header( 'Location: index.php' ) ;
  }

  # invalid login
  else if ($record == null) {
    echo "
    We cant find you on the system.
    <br/>
    Please return to the <b><a href='login.php'>Login</a></b> page and ensure that 
    <br/>
    you have entered your details correctly.
    <br><br>
    <b>Warning</b>: You willl be redirected  back to the Login Page 
    <br> in <b> <span id='counter'>10</span> Second(s)</b>";
  }
?>

The main reason for asking this is that when I login inputting:

'user'); DROP TABLE Login;--'

it doesn’t drop the table.

My question is: Am I typing in the right SQL injection?

Answer 1

This is vulnerable:

mysql_real_escape_string($userid);
mysql_real_escape_string($pword);

does not return the variable. Use:

$userid = mysql_real_escape_string($userid);
$pword = mysql_real_escape_string($pword);

If you really want to take care of all vulnerable SQL injections try to move to PDO. Here is a nice tutorial

Answer 2

The injection doesn't work because mysql_query only does the first query till the ; then it stops so its not possible that way, correct me if I'm wrong.